A Closer Look at The Commission Report on the Deepwater Horizon Disaster

The following guest essay was written by David Whelpton. David is a private investor in the oil and gas industry. His blog is Knowledge and Investing. Below, David goes through the highlights of the report to the President on the Deepwater Horizon disaster, explaining the commission’s findings of what went wrong, and detailing some specific differences between BP and some other oil companies that may have led to a deficient safety culture.

————————–A Closer Look at The Commission Report on the Deepwater Horizon Disaster

The National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling has released its report to the President entitled, “Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling.” It is dedicated to the 11 men who perished on the Deepwater Horizon drilling rig. The seven-member Commission was charged with investigating the disaster, analyzing its causes and effects and providing recommendations to minimize future risks. At 398 pages, it provides a thorough account of what happened in the calm waters of the Gulf of Mexico on the night of April 20, 2010. It makes for some interesting reading and lays the responsibility for the accident on many parties—not just BP.

The investigation finds that the accident was caused by a series of mistakes, resulting from poor management, inadequate communication and a failure to appreciate the tremendous risks inherent in deepwater drilling.

Both industry and government must make major changes in order to achieve a higher level of safety in oil and gas exploration on the outer continental shelf. According to the Commission, industry must rededicate itself to improving its safety culture and government must provide more effective regulatory oversight.

The Lead-up to the Blowout

On April 9th the Macondo well experienced an event known as “lost returns”. The drilling mud used to contain the pressure in the hydrocarbon (oil and gas) reservoir did not completely circulate in the wellbore. Some of the mud began flowing into cracks in the pay zone instead of returning to the drilling rig.

To safely drill a well, crews must balance the weight of the column of drilling mud with the pressure exerted by the hydrocarbon reservoir. If the weight of the mud is too low, hydrocarbons may enter the well and rise to the surface producing a “kick.” And if the flow of hydrocarbons from the well becomes uncontrolled it results in a blowout. On the other hand, if the mud is too heavy, it may damage the reservoir and lead to “lost returns.”

This “lost returns” event affected the drilling team’s perception of the nature of the risk they faced:

“[BP Wells Team Leader] John Guide explained after the incident that losing returns ‘was the No. 1 risk.’ He and the other BP engineers worried that if their cementing procedure placed too much pressure on the geologic formation below, it might trigger another lost-returns event similar to the one on April 9.”

When BP began temporary abandonment procedures for the well, its choices were influenced by the “lost returns” event and it chose procedures that would minimize the risk of formation damage at the expense of increasing the risk of “kicks” or blowouts.

BP worked with Halliburton to select a formula for the cement slurry. BP elected to use nitrogen foam cement that was lighter than normal and would therefore exert less pressure on the reservoir. Halliburton’s test of this cement indicated that it was unstable. But while the test results were delivered to BP, there was no analysis provided by Halliburton or communication to the effect that the test was not entirely successful. It appears as though BP did not examine the data in the report but simply concluded the cement would be stable given that Halliburton did not indicate there were any problems. An earlier test on the foam cement failed more severely but Halliburton did not report the results of this test to BP. After the disaster, Chevron conducted independent testing on the cement slurry used at Macondo and concluded the formula was unstable. Furthermore, BP also limited the volume of cement pumped down the well and chose a less-than-optimal rate of cement flow. While protecting the formation from damage, these compromises increased the risk of a blowout.

Despite the compromises evident in the cement procedure and an earlier decision to use a riskier long string well design, BP decided to dismiss a team of Schlumberger technicians who were on standby at the rig to perform cement evaluation tests if required. Skipping the test saved BP both time—leasing the Deepwater Horizon reportedly cost as much as $1 million per day—and Schlumberger’s $128,000 fee.

The Negative Pressure Test

While the blow-out was a result of a series of mistakes, along with broader regulatory and corporate safety culture issues, there is one key test that—had it been properly interpreted—could have likely prevented the blowout. This test was the negative pressure test performed on the day of the blowout. The report states: “The failure to properly conduct and interpret the negative-pressure test was a major contributing factor to the blowout.” And when the BP team decided to skip the cement evaluation tests and send the Schlumberger team home they chose to rely entirely on the negative-pressure test to determine the integrity of the primary cement job.

In defense of the personnel conducting the test, BP and Transocean had no policies or procedures for running or interpreting negative pressure tests and the BP well-site team had not received formal training in this regard.

The rig crew performed the negative pressure test by bleeding off pressure in the drill pipe all the way down to zero pounds per square inch and then waiting to see if it built back up. The team performed this action three times but each time the pressure built up after it was bled off. After the discussing the situation with the Transocean crew, the BP Well Site Leader chose to perform an alternative negative-pressure test, this time on a pipe that connects the blow-out preventer to the rig called the kill line. The test on the kill line was successful and BP mistakenly concluded that the negative pressure test had confirmed the integrity of the cement job. Although the test on the kill line succeeded, the pressure on the drill pipe remained elevated and the Well Site Leaders and crew never reconciled the conflicting pressure readings even though they should have been identical.

The report concludes that “BP’s fundamental mistake was its failure…to exercise special caution (and, accordingly, to direct its contractors to be especially vigilant) before relying on the primary cement as a barrier to hydrocarbon flow.”

The testing and cement jobs proceeded without an appreciation for the risks involved given the context of prior decisions. Compromises in well design and cementing procedures did not result in a more cautious approach nor was there a communication of the need for vigilance.

Additional findings:

BP’s decision to choose a well design consisting of a long string production casing instead of a liner led to a higher risk of cement failure.

BP made multiple changes to the temporary abandonment procedures in the weeks prior to the blow out but the changes did not go through any sort of formal risk assessment or review process.

BP installed only six centralizers on the production casing instead of the recommended 21 centralizers. Furthermore, BP neglected to inform Halliburton of the number of centralizers installed.

BP replaced 3,300 feet of heavy drilling mud with lighter seawater and this put unnecessary stress on the cement job.

When the BP and Transocean staff on the rig noted an anomalous pressure reading while attempting to convert float valves they concluded that the pressure gauge they had been relying on was broken. “BP’s team appears not to have seriously examined why it had to apply over four times the 750 psi design pressure to convert the float valves.”

In the minutes prior to the blowout the Transocean crew failed to notice an increase in pressure in the well—they failed to recognize that a natural gas kick was occurring until it was too late and the blowout was uncontrollable.

The Commission cites a lack of automated alarms in the displays used to monitor well pressures as a contributing factor.

Failure of the Deepwater Horizon’s Blow-out Preventer, possibly due to poor maintenance, was a major contributing factor in the blowout.

Training of key engineering and rig personnel was inadequate.

The report cites poor management of decision making processes at BP and its contractors.

There was a lack of communication within BP—for instance between offshore and onshore staff—and poor communication between BP and its contractors. Information was compartmentalized and not fully shared.

Transocean draws criticism for not properly monitoring the well and failing to divert mud and gas away from the rig at the start of the blowout. The Commission also cites Transocean’s failure to communicate lessons from an earlier near-blowout in the North Sea on December 23rd 2009. The crew of the Deepwater Horizon was not aware of this event nor the safety lessons gained from it.

To quote the report:

“Operators must assure that better practices for maintaining well integrity and the isolation of hydrocarbons are used at all times. And they must insist upon heightened vigilance throughout all the steps from the inception of well design to the consideration of changes during drilling operations. Similarly, protocols for testing of blowout preventers must be put in place and enforced.”

Report Omissions and Shortcomings

The report covers quite a few bases but there are a few areas that warrant more attention.

Incentives are recognized as an important component in a strong safety culture but we learn very little about what compensation system BP had in place. At a Commission hearing in November 2010, CEOs from ExxonMobil and Shell described compensation systems that “reward employees and contractors who take action when there is a safety concern even though such actions cost the company time and money.” At BP we’re left to assume that such safety-oriented compensation systems are lacking.

Perhaps as a courtesy to the firms’ legal departments, the report doesn’t go as far as saying that BP, Halliburton and Transocean purposefully sacrificed safety for time and money. But it acknowledges that many of their decisions resulted in cost savings.

Compensation is a driving motivator. If a manager tells employees to take safety seriously but rewards them with financial compensation for cutting costs and saving time then safety is compromised. It takes an incentive system to put safety into practice. Otherwise, financial pressures will systematically bias decision making.

The report states:

“Better management by BP, Halliburton, and Transocean would almost certainly have prevented the blowout by improving the ability of individuals involved to identify the risks they faced, and to properly evaluate, communicate, and address them.”

I agree with the statement but “better management” must refer to the implementation of reward and incentive systems, policies and procedures from the top of the organization on down in order to create a robust safety culture. The faults lie beyond the mere decision-making skills of the individuals involved in the accident.

The issue of overconfidence is mentioned but not fully explored. Overconfidence is a common type of flawed thinking that is recognized and studied in the field of Behavioral Finance. Yet, confidence is an important trait when it comes to business. A manager who projects confidence and decisiveness is more likely to advance than a manager who warns of risk and uncertainty. Businesses naturally select leaders who are confident. And the firms that push the boundaries of exploration must have a can-do attitude in order take large commercial risks when targeting deepwater prospects. But this attitude can conflict with the safety mentality required for offshore drilling operations. The deepwater will continue to draw trailblazing explorers with an appetite for risk. And although a dry well is a manageable risk, a leaking well is a potential disaster.

In this case, the BP Well Site Leaders demonstrated overconfidence with regard to their assumptions. The Site leaders assumed that the well was contained by the cement. They seemed to refuse to be able to imagine that hydrocarbons were leaking. Such a scenario was inconsistent with their mental models. The team did not properly interpret anomalous pressure readings because they would not consider the possibility that the well was flowing. Instead, they kept running tests and generating explanations consistent with their assumptions.

Even after the blowout during efforts to contain the spill BP continued to demonstrate overconfidence:

“The government saw its pushback as essential because BP would not, on its own, consider the full range of possibilities. According to one senior government official, before the increased supervision, BP ‘hoped for the best, planned for the best, expected the best.’”

Another subject that gets little mention is the use of checklists. The airline industry has used checklists to successfully deal with complexity and reduce risk. As drilling operations proceed to deeper and more hostile environments the tasks required of a rig crew will only get more demanding and complex. Indeed, the report recognizes that technological innovation is an industry constant. Checklists impose a disciplined, structured approach to complex tasks.

A Culture of Safety

The industry needs to overhaul its safety culture and adopt an ethos of caution and of questioning. Industry personnel must fully consider risks created by pressures to save time and money. Accidents in 2003 in the North Sea and 2005 at the Texas City refinery were due in part to a culture at BP that put a strong emphasis on controlling costs.

When examining past accidents at BP, the report cites the firm for focusing heavily on personnel safety while at the same time neglecting process safety and not maintaining its facilities: “BP management paid attention to, measured, and rewarded personal safety rather than process safety.”

The emphasis on a safety culture must be industry wide. At Macondo, contractors played an important role in the series of mistakes that took place. The report asserts that all three companies—BP, Halliburton and Transocean—failed to apply rigorous process safety measures. These firms are major players in the offshore industry and the report characterizes the safety issues as systemic to the industry in general. The report points out that the industry’s reputation and viability is dependent on its lowest-performing members.

The report targets the U.S. offshore industry and regulators for particular criticism. In comparison to the United Kingdom, Norway, and Canada, the U.S.—at the time of the Macondo blowout—did not require offshore operators to make what is known as a “safety case.”

Instead of a prescriptive approach to regulation, a “safety case” requires that each operator demonstrate consideration of all the safety risks and provide appropriate risk management systems. The safety burden falls on the operator to prove that the exploration or production operations will be safe rather than relying on a regulator to prescribe and approve a series of fixed measures. With new technologies and exploration methods a “safety case” approach is essential as operators venture into ever-deeper waters.

The Effort to Contain the Well and Protect the Coast

As damaging as the environmental impact has been, some of the worst fears and wildly pessimistic expectations that were reported at the height of the disaster have not come to pass. Most of the oil never reached the coast because of favorable winds and ocean currents. In addition, a large volume of oil was likely consumed by oil-eating microbes and evaporation.

Nevertheless, the response to contain the spill demonstrated that neither BP nor the government was prepared to deal with a spill of Macondo’s nature. In the immediate aftermath of the disaster the public expected the federal government to spearhead the effort to cap the well. But it took time for the various government entities to get up to speed and become fully involved. At the onset of the crisis, “neither the MMS nor the Coast Guard had the expertise or resources to supervise BP’s well-containment efforts.” Eventually the government took on a supervisory role and participated in the decision-making.

In its oil spill response plan BP listed Peter Lutz as a wildlife expert on whom it would rely although he had died years before BP submitted the plan. The plan also listed seals and walruses at two species of concern although these species are not present in the Gulf habitat.

Yet, the urgency with which BP approached the containment effort was evident:

“Each team had what amounted to a blank check. As one contractor put it, ‘Whatever you needed, you got it. If you needed something from a machine shop and you couldn’t jump in line, you bought the machine shop.’”

When the spill was at its worst some observers were questioning the viability of BP itself. Could it actually go bankrupt? In an interesting bit of irony it turns out that BP was facing bankruptcy concerns in 1989 when, in partnership with Shell, it discovered the giant Mars field in the Gulf of Mexico. According to the report, the Mars discovery saved BP from bankruptcy.

The initial inability to accurately measure the flow rate of leaking oil hampered containment efforts. The current estimate of the flow rate is 60,000 barrels per day although earlier estimates were drastically lower.

The report is critical of Louisiana Governor Bobby Jindal and efforts to construct barrier berms off the shores of Louisiana. About six percent of the berms were completed prior to the well being capped. According to the Commission, the berms were the most expensive measure deployed to fight the spill. The berms were funded by BP but their construction was “based primarily on the demands of local and regional interests rather than on a scientific assessment of its likely efficacy.” The report goes further, stating: “The Coast Guard should issue guidance to establish that offshore barrier berms and similar dredged barriers generally will not be authorized as an oil spill response measure in the National Contingency Plan or any Area Contingency Plan.”

Government Oversight – The Regulatory Aspect

The Minerals Management Service (MMS), an agency now known as the Bureau of Ocean Energy Management, Regulation and Enforcement, is portrayed as a toothless regulator that lacked resources and expertise.

Faced with lobbying efforts from a powerful trade association in the American Petroleum Institute, the MMS lacked the political autonomy required to implement strong safety regulation. A lack of political leadership in successive administrations and congresses contributed to a situation where regulators lacked resources, personnel, technical expertise and authority:

“MMS ‘does not provide formal training specific to the inspections process, and does not keep up with changing technology. Some inspectors noted that they rely on industry representatives to explain the technology at a facility.’”

Furthermore, the MMS had a conflict of interest because it collected revenue from leasing and production activities. The report contends the agency was more focused on generating government revenue than enforcing safety.

And these challenges occurred in an environment where firms were drilling into deeper waters, which brought new technologies and increased the risk of an accident.

Concluding Thoughts

The report acknowledges that offshore oil and gas will play a crucial role in America’s domestic energy supply for many decades to come.

There are three fundamental messages in the report. The first is that the deepwater does not have to be abandoned because it can be explored and its resources developed in a safe manner. The second message is that the oil and gas industry must fundamentally transform its safety culture. The commitment to safety must be paramount and relentless. The final message is about the need for better government oversight and regulation. Looking to the future, the Commission hopes that a revamped industry safety culture and a new oversight regime will be capable of preventing the next disaster, not the last.

References

Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling, Report to the President, National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, Jan. 11, 2011.

By Charles Powars on February 24, 2011 at 5:14 pm

I suspect this is a good and objective analysis of what actually happened, but it lacks the “Sound Bite…Gotcha” characteristic that the main media (and most of us) love.

The comment regarding overconfidence struck home with me. We have evolved a culture that respects confidence. Unfortunately, we often mistake confidence for competence. For an excellent study of this tendency, I recommend (don’t be put off by the odd title) “The Invisible Gorilla” by Chabris and Simons.

Excellent review, thank you. Was especially interested, as long ago worked in family business of water well drilling. Schram rotory rigs like the one drilling rescue hole for Chilean miners. Before the air technology, mud, and yes my teen age summers mixing mud and welding casing.

The point of checklists very important and only recently given credit as an effective hands on workable quality system. KISS systems most effective, reason number one you can’t inspect or regulate quality improvements at least upon effective daily workable needs. Process safety is a factor of quality since the product is the producing well.

I have learned Industrial quality control systems not unlike hospital systems. In fact health field only recently catching up partially to automotive. Medical equipment manufactures follow “Good Manufacturing Procedures” that basically requires in house systematic feedback of problem solving. In other words a quality system on paper that exhibits self correcting actions. The auditors merely pick up documentation to evaluate if the company is doing what they say they need to do. For instance a small shop would have minimal outline and paperwork for proving quality. But, they must use the system they devise and the system should be dynamic. Meaning the quality system adapts per the real life shortcoming needs. We need to understand no quality system is perfect. Deming was the maestro of this radical thinking.

Oil rig operation bungling appears typical for poor quality. No heavy handed regulations could possible improve quality other than short term intimidation threats. Government should require the off shore drilling sector to put in place an effective dynamic quality plan. Evaluate the plan for self improvement control and efficacy. Inspect that they are utilizing the plan they say needed and maybe do some unannounced testing for weakest link. Completely, ignore companies demonstrating excellence. We want results, not ever more bureaucratic union workforce. The oil exploration sector may need a review committee made up of technical professionals whom meet annually to foster coordination of information and standardizations. A work session to share concerns and solutions and develop best practices for safety. MMS to coordinate the event and foster good working relations for all interested parties. They still maintain the warrant pad for motivation.

“The point of checklists very important and only recently given credit ..”

Checklist have been around a long time. I was using a startup checklists navy nuclear program in the 70s and I am sure they predated my time in the program. Ask Wendlell and I am sure air force pilots used them wau back when too.

“reason number one you can’t inspect or regulate quality improvements at least upon effective daily workable needs.”

What? BS, if you are going to kill people you better be inspecting every step. You do not need a QA adulator standing behind to do quality work.

“Process safety is a factor of quality since the product is the producing well.”

Sounds like Forest might be confused. Process safety determines the level of quality. For example, in a US nuke plant; rector coolant pressure boundary is ‘Nuclear Quality Group A’ because process safety indicates the potential for off site dose. High pressure components without radioactive material would be built to ASME codes and standards because process safety indicates the potential for killing workers but not the public. However, if the components had a safety function such as protecting the rector coolant pressure boundary then it would be ‘Nuclear Quality Group B’

The point here is that process safety and personnel (industrial) safety are two different things. During a hazards identification phase of process safety, engineers might identify that adding two chemical out of order could cause an explosion. Failure do so would be a latent quality error. It might not be detected for years and the person killed would not be the engineers. Part of process safety is to provide tools like check lists and personal protective equipment to workers so they can practice personnel safety. You have to do both to keep from killing people.

“In fact health field only recently catching up partially to automotive.”

The NRC is required to provide an annual report to congress of significant events in the nuclear field. It has been many years since there has been such a problem at a nuke power plant. Well drillers would lose radioactive sources to make the list, The number of problems with nuclear medicine was scary although you have to keep mind when you are dealing with too many very sick people, that production pressure is just trying to keep people alive. I am happy to say that the last report I read only had a few events.

“No heavy handed regulations could possible improve quality other than short term intimidation threats.”

Forest you may want to read DEEPWATER. There was essentially no government oversight of offshore rig safety. The same agency that collect royalties was responsible for safety and environmental oversight. While offshore drilling has increased and gotten more complex s since the the 70s the budget for oversight had not. I recommend you read DEEPWATER.

The heavy handed NRC charges by the hour. The NRC does not check each piece of paper. The NRC checks that the nuclear industry check each piece of paper. When the NRC determines that an adequate safety does not exist, the nuke plant is not going to operate for a long time.

Did hear the “Deepwater” book review on Diane Rheem. Her show is frustrating, yet informative. You have to be a consumer of choice and know the bias. Some rare shows very informative, but unfortunately most have an agenda and a setup.

Just my meager water well experience, alarmed me to much of the propaganda floating about media. Media has a huge potential to be a service to citizens. But, unfortunately, that has not occurred in human events.

Your evidence is accurate per my experience and knowledge; just your conclusions not shared. Yes, Pressure Vessel Code long established and historically of good quality service. Government operates upon the code pretty much like what my post say the optimum solution, at least for industry. This code developed over long time period, developed per disaster of poor science of old. Steam engines really thrust the material science into high gear. Before that gunpowder. BTW, interesting tidbit….was doing a history investigation back in days. We did a fundraiser (school) and sold model cannons. Some bore the model out for operational mode. Come to find out gun makers tested barrel safety with simple setup and 3x gunpowder charge. Revolutionary times, materials and process so crude, you never were really sure of end result. Even gun owners preformed the trick per safety concerns. Modern times that safety check is routinely used and deemed very effective upon home black powder gun building.

Back to boiler code- the code has many provisions to accept new technology; just you have to prove the process capability. The code has good elements for covering basics amongst the maze and provides a structure for record keeping. Manufacturing is generations ahead; the code is mostly fluff for them. Now, the challenge is for day in day out peak quality repeatability. For decades the code has been of little service, but that’s a good thing right? Meaning were way past the basics, but as per my gunpowder barrel test above, we need it all. I will say the Code would serve better currently if overhauled to simplicity as the production need gone. It serves best for startups and craft business. Meaning KISS. However, we have very good articles summarize and demystify the process, so it’s probably a waste to overhaul the code. Probably, regs main use, currently, a litigation or bargaining tool. Nuclear code picks up from boiler code with such things as x-ray examination of every part per lab analysis and strict record keeping. Funny, I’ve seen stick welding in the hand to total computer control of parameters with robots. Both process capable in the right hands to complete nuclear weld quality.

The code is referred to often per politics of government keeping us safe. Meaning high school text books present horrifying steam boiler explosions back upon the developing infancy of this technology with the accompanying evidence of a mighty need for government. It is a misguided history lesson, guess even back then politics learned the trick of timing. You know to jump in front of the marching band just in time to award oneself credit. Some things never change.

The point made of inspecting quality per oversight. Yes and no. You can’t inspect quality into a product or even safety another quality derivative. You can lead a horse to water, but try to make a disgruntled worker drink. The best shop I ever had the pleasure to work for, a small private company that fabricated parts for steam pressure vessel code. A shop of 100 or so employee who were treated like family. Respect for all employees within the workforce was part of the job. Now, trouble makers were given the boot as to respect those ensuring quality, so the wheat was separated from chaff and this too improved relations of good workers. Pay and benefits were average, working environment excellent. This company had achieved the highest quality ratings ISO 9001 for one. You know inspectors never ventured to production. Management simply stated the fact employees who do the work are responsible. These workers had latitude and expected to seek help if in need or confused. They could simply walk where they needed to, either the CEO or the machinist/welder next door. Just a different culture, which for a small company has worked tremendously well. It was a production shop, and hard work was exemplified at all levels. Coworkers would give you a dirty look if it appeared slacking, even production crew. Sure, I’m giving only the positives, but overall one of the best.